Add a script to enforce usage of sign-off as required by the contributing.md

[MTRNord]

This adds the same CI as seen over at https://github.com/the-draupnir-project/Draupnir which itself in turn was based upon the CI seen in https://github.com/matrix-org/backend-meta

This should enforce that sign off actually happens by external contributors.

This currently cannot check for sign off in PR text or comments. We should discuss if we a) want this kind of ci b) if we need to deal with comments and PR description here as well. (cc @matrix-org/website-wg )

✔️ Checklist

• Check for common mistakes:
  • Wrap plain URLs in <> to linkify them (learn more).
  • Use the right level of headings: The page title will use a level 1 headings, so your headings should use level 2 and below.
  • Use internal links: when linking to another page on https://matrix.org, use the Zola [label](@/target.md) syntax.
• For blog posts:
  • Verify the date and post ordering on the /blog page, especially for multiple posts on the same day. Prefer UTC format, e.g. 2025-12-01T14:00:00Z for Dec 1st, 2025, 2pm UTC.
  • Set the correct author and category. Browse existing ones at https://matrix.org/author/ and https://matrix.org/category/ to match them.
• Let us know if you are contributing in a specific role, such as on behalf of an organisation or team, for example.
• Let us know if your PR is time-sensitive in any way.
• Mention any issues related to the PR. Use GitHub keywords as appropriate.
• Your individual commits or pull request is signed off.

[MTRNord]

Alternative suggested by @HarHarLinks would be https://github.com/apps/dco